CISA flags PolyShell and Brotli flaws as exploit traffic surfaces

Feeds.4Sysops •IT News • October 28, 2026

CISA has added Adobe Commerce’s PolyShell flaw and Google’s Brotli decoder vulnerability to its Known Exploited Vulnerabilities catalog. The Brotli issue, which affects software such as Node.js and Python packages, had already been traced across runtimes in prior vulnerability coverage ; new telemetry now reports exploit attempts in the wild. Meanwhile, PolyShell attacks have compromised hundreds of online stores. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CISA Flags Critical Brotli Node2Shell Flaw Amid Active Exploitation On October 27, CISA added CVE-2026-111497, a critical vulnerability in Google's Brotli decoder, to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation. The flaw, known as Node2Shell, affects Brotli versions 1.0.3 to 1.2.0 and can lead to memory corruption, denial of service, or remote code execution. Federal agencies have until November 10 to patch their systems. The vulnerability impacts various platforms, including Node.js, .NET, Envoy, and PAN-OS, with patches already released by several vendors. Security firms have reported exploitation attempts in their honeypots, indicating the flaw is being actively targeted. Adobe Commerce's PolyShell flaw was also flagged in the same update, highlighting ongoing threats to online stores. 2 sources 73

Extracted Entities

CISA flags PolyShell and Brotli flaws as exploit traffic surfaces

The full story

Extracted Entities

Companies (2)

Tools (2)

Vulnerabilities (2)